Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe
-
Size
643KB
-
MD5
71b1901d05fccf33a088bbb6fa09ed3c
-
SHA1
d85d6847b167afa183430f93ce61f172f1aa0fef
-
SHA256
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4
-
SHA512
7085f3ff512063976fef1feaa1e535286996082cdf20c8ca28b2f0d14207635d9c1c17232c78d09351f6248ebb3fc712957038f8383e61b600d8166d617b5715
-
SSDEEP
12288:UWvWgQs69RZ2RdqiHgzlnU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMg:Nv7mRbiHSGiHb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 2832 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe Token: 33 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe Token: SeIncBasePriorityPrivilege 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe Token: SeDebugPrivilege 2832 Taskmgr.exe Token: SeSystemProfilePrivilege 2832 Taskmgr.exe Token: SeCreateGlobalPrivilege 2832 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe 2832 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2832 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 103 PID 1928 wrote to memory of 2832 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 103 PID 1928 wrote to memory of 2832 1928 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe"C:\Users\Admin\AppData\Local\Temp\86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2360
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:81⤵PID:2564